Security FAQ

From Joomla! Documentation

This security list has been compiled from several sources. Some of these sources are linked at the bottom of this article. As such you may find duplicate suggestions. DON'T skip anything because of this!

This list for the main part does not provide instructions. It is only a list for you to check off each item as you perform the tasks.

Check regularly for updates for Joomla, PHP, SQL and EVERY extension you use.

Avoid encrypted code in extensions.

Use some form of intrusion detection either through a cron job or an extension (like Eyesite).

Check your log files OFTEN for unusual activity.

Test your site for weaknesses or hire someone to perform this for you. Make sure you tell your host first what you are doing or you may get your site removed from the server!!!

Ask your server if they offer PHPsuExec, php_suexec or suPHP.

Use php.ini files if your server allows. With this you can disable functions that are not needed or dangerous.

Register_Globals = 0 (off) Many servers default this to ON.

allow_url_fopen = 0 (off)

expose_php = 0 (off)

safe_mode = 0 (off)

Use .htaccess to add extra protection to your administrator directory or use an extension (like kSecure).

Move configuration.php outside of your public directory.

Get an SSL certificate for financial transactions and other sensitive data exchange.

Use open_basedir. It limits which files/folders can be opened.

Change the paths (directories) where your log, temp (tmp) files are stored. Don't just move them, you have to change the setting in Global Config as well. You also have to ensure your new paths fall under the scope of open_basedir.